Tag

Engineering

11 posts tagged “Engineering”.

11 December 2023 · 2 MIN READ

RouterOS visibility using Elastic Security

xHaving visibility into host events gives you an insiders view to what is happening on a desktop or server. This information is the primary domain for detecting threats on endpoints, however this information isn’t always available or is not available at all for non general purpose operating systems. This article will give you a jumping off point to get logs of all kinds from RouterOS into Elastic using Elastic Agent

26 September 2023 · 1 MIN READ

Backing up Proxmox VMs to Backblaze B2

There are many ways to backup VMs on a Proxmox hypervisor : Use their “Proxmox Backup Server” — this is a great option because it offers incremental backups & deduplication. Use a ZFS volume to store your VMs and use zfs send to backup the snapshots to a remote system Copy the backup files to S3 compatible storage such as Backblaze B2 or Amazon S3. We will be doing the latter due to the fact that is it simple and cost effective.

17 October 2022 · 1 MIN READ

Properly renaming Proxmox nodes

In the event you need to rename a Proxmox PVE node you will probably stumble upon this article : https://pve.proxmox.com/wiki/Renaming_a_PVE_node I followed most of these instructions, but missed a crucial bit : This must be done on a empty node. Yeah…whoops! After rebooting you might find that your VMs are not running! Thankfully it is a simple-ish fix: Backup your /etc/pve directory Move the files from the /etc/pve/nodes/oldnodename/qemu-server to their respective new directory, for example to /etc/pve/nodes/newnodename/qemu-server

19 April 2022 · 1 MIN READ

Using Google Chat for Elastic Security Alerts

If you’re a fan of Google’s new spaces feature and want to have one less app to check you may be considering replacing Slack with Google Chat or Spaces. Here is how to configure an Elastic connector so that you can get alerts and notifications in Google Spaces : Add an incoming web-hook in the space that you want to receive notifications in. I recommend a dedicated space per environment so you can mute and better manage notifications

18 April 2022 · 2 MIN READ

Getting Dockerd to behave with Snap

When you install docker using snap on Ubuntu you can’t configure it using the default config files dues to the isolated nature of snapd. Here is how you can configure dockerd to listen on a network socket when using snap on Ubuntu First, edit /var/snap/docker/current/config/daemon.json and add a hosts line like so: { "log-level": "error", "storage-driver": "overlay2", "hosts": ["tcp://1.2.3.4:2376"] } Then run : snap restart docker You can now connect to Dockerd over the network (remember to set the TLS cert and secure the service appropriately) by specifying the socket

27 February 2019 · 1 MIN READ

Renaming multiple files

When trying to rename multiple files in a directory tree that have the same name — such as Azure signin logs that are written to Azure storage accounts — if you are like me then your first thought would be to use the find . -name *.json -exec mv {}; pattern. The problem is that find executes only one mv here and not one for each file as you would assume. To achieve this we need the help of our venerable bash shell :

2 January 2019 · 1 MIN READ

Digital Ocean dictates what nodes you can add to their Kubernetes service

When one pays money to rent the compute resources from another it should be the customer — not the provider — that decide whether a system can run a workload or not. Simply put I signed up for the Digital Ocean Kubernetes preview and it worked well. Super easy way to get started with Kubernetes and in my case a great way to run periodic jobs in a secure (using k8s secrets) and repeatable (defining my CRON job in a YAML file and ‘applying’ it to the cluster) way.

23 July 2018 · 2 MIN READ

Using Amazon Athena to check if a password has been pawned

Ever wonder if a password you use has been used before or more importantly whether this password is widely known to hackers? Troy Hunt runs an excellent site called “Have I Been Pwned” that allows one to check if their account details have been compromised as a result of a data breach. This works well if you want to check a dozen or so accounts but what if you want to check a couple thousand or million passwords?

6 September 2017 · 1 MIN READ

FTDI drivers on OSX reap havoc with USB ports

In order to update the firmware on pycom.io’s Lopy development boards you need to install the FTDI Virtual COM port drivers (shasum b57377e10de1c8ae9ddaffa147e4cc529c3571b512bba4798b2b6054d4fabd92) for OSX. After an indeterminate amount of time my left USB port on my Macbook Air stopped working properly. If I listed the USB devices on the system : system_profiler SPUSBDataType The device would be listed yet the device details would not be present (and would not work To solve this issue you basically need to remove the driver (I will just use the serial port on my raspberry pi or something like that

16 August 2017 · 2 MIN READ

Automate your DevOps environment with hyper.sh and a Yubikey

Hyper.sh containers make a great devops workstation for a number of reasons: You can shut them down when not in use which saves money and also reduces the attack surface. Hyper.sh containers have a private Layer 2 segment which can be fire-walled using security groups and which are not shared with other customers. Hyper containers have better isolation than Docker containers (hardware isolation, just like a VM) However starting your devops workstation every time you start the day is painful, that is why I created a little python script that uses osquery to start up my workstation when I plug in my yubikey.

4 July 2017 · 2 MIN READ

Rackspace please add support for Slack notifications to Rackspace Intelligence

Rackspace Intelligence is a server / service monitoring service that allows customers to monitor their systems via remote service checks as well as using an agent. Here’s what is good about Rackspace intelligence: It’s free if you are a Rackspace customer or run Rackspace VMs! Why payPingdom$11 / month a measly 10 checks per month when you can monitor unlimited servers for gratis? Rackspace intelligence does everything you need for basic remote uptime checks and service performance monitoring. There is also an install-able agent that allows you to monitor CPU / memory / etc. which provides substantially more power to keep an eye on your infrastructure.